5.7
CVE-2011-3588
- EPSS 0.54%
- Veröffentlicht 15.02.2014 14:57:07
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginThe SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Kexec-tools Version <= 1.102pre-126
Redhat ≫ Kexec-tools Version <= 2.0.0-188
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.54% | 0.413 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.7 | 5.5 | 6.9 |
AV:A/AC:M/Au:N/C:C/I:N/A:N
|
http://rhn.redhat.com/errata/RHSA-2011-1532.html
http://rhn.redhat.com/errata/RHSA-2012-0152.html
https://bugzilla.redhat.com/show_bug.cgi?id=716439